DATA PROTECTION (JERSEY) LAW 2005: YOUR RIGHTS AND HOW TO ENFORCE THEM

Transcription

1 DATA PROTECTION (JERSEY) LAW 2005 YOUR RIGHTS AND HOW TO ENFORCE THEM GD2a 1

2 2

3 DATA PROTECTION (JERSEY) LAW 2005: YOUR RIGHTS AND HOW TO ENFORCE THEM Introduction 1 Your rights and how to enforce them 1 What is the role of the Data Protection Commissioner? 2 What rights do I have under the Law? 4 What is in the Information Packs? 6 Other publications in the series 7 Useful contact information 8 3

4 Introduction This leaflet is part of a series of eight leaflets which explain your rights under the Data Protection (Jersey) Law 2005 and the procedure involved if you wish to enforce your rights through the courts. It gives you general facts about the Law and the body responsible for enforcing it. Details of our other leaflets can be found at the back. If you would like any of these please contact the Data Protection Commissioner s Office. You will find all our contact details on the back cover. Your Rights and How to Enforce Them The Data Protection (Jersey) Law (the Law ) came into force on 1 December It sets out rules for processing personal information (known as personal data) and applies to many paper records as well as those held on computer. Many people and organisations (data controllers) have details about us (data subjects). The growth in the use of personal data has many benefits, like better medical care or helping fight crime. There are also some possible problems. It could cause you problems if information about you is recorded incorrectly, is out of date, or is confused with information about someone else. The Law requires data controllers to comply with the rules of good information handling practice, known as the data protection principles. The principles require, amongst other things, that personal data are processed fairly and lawfully, are accurate and relevant and are subject to appropriate security. 1

5 What is the role of the Data Protection Commissioner? The Data Protection Commissioner (the Commissioner ) is responsible for enforcing the Law and for providing advice and assistance to both data controllers and data subjects. The Commissioner s focus is on seeking to promote compliance and the following of best practice. Failure to observe the data protection principles is not a criminal offence. The Commissioner does not have any powers to award compensation to a data subject affected by the processing of their personal data in breach of the Law. Compensation can only be awarded by a court in the event that the data controller refuses to compensate a data subject. If an individual believes him or her self to be directly affected by the processing of his or her personal data, and has been unable to resolve the matter with the data controller, s/he may ask the Commissioner to assess whether the processing is likely or unlikely to have been carried out in compliance with the Law. The Commissioner is not required to come to a firm determination as to whether there has been a breach of the Law. She is simply required to decide whether, on the information available to her compliance with the Law is, on balance, likely or unlikely. If the Commissioner makes an assessment that the processing by the data controller is unlikely to have been carried out in compliance with the Law, the Commissioner will then decide whether remedial action is warranted. If so, she will try to achieve this with the co-operation of the data controller. If this is not possible, the Commissioner has discretion as to whether to take any action and as to what action to take. 2

6 An assessment will inform you as to whether the matters that concern you are likely to involve a breach of the Law. It may help you to resolve a dispute and in making a decision as to whether to take legal action against a data controller under the Law. However, an assessment from the Commissioner is not necessary to make a claim to court. It is important to note before starting any legal action against a data controller, that an assessment from the Commissioner stating that it is unlikely that there has been compliance with the Law is not binding on a court and the Judge may disagree with the Commissioner s findings. An important difference between an assessment of the Commissioner and the judgment of the court is the evidence upon which the respective decisions may be based. Further information relating to assessments may be obtained from the Commissioner s website or by contacting the Commissioner s Office. The purpose of this publication and the Information Packs referred to is to identify your rights under the Law and to assist you in solving any problems you may have with a data controller who you think may be processing your personal data in breach of the provisions of the Law. Information is also included to explain how to issue proceedings against a data controller through the civil courts. 3

7 What rights do I have under the Law? The Law gives you various rights to control the way your personal information is used, including the following: I. The right to find out what information is held about you on computer and in some paper records. This is called the right of subject access. If you would like more information on how to make a subject access request, please refer to the leaflet called Subject access a guide for data subjects. II. If you wish to find out what credit reference agencies report about you and how you correct mistakes on such reports then you will need to refer to the leaflet called No credit? III. The right to take steps to prevent your personal data being processed if the processing is likely to cause you or someone else to suffer substantial damage or substantial distress which is unjustified. If you would like more information on how to take such steps and what to do if the data controller does not lawfully do as you ask, you will find further information in Help! How can I stop them processing my personal information? IV. The right to require the data controller not to use your personal data to market you with products, services or ideas. If you would like more information on how to do this and what to do if the data controller does not do as you ask, you will find further information in: Stopping unwanted marketing materials. 4

8 V. Sometimes individuals or organisations will use a computer to process information about you, in order to take a decision that will affect you. An example of this is an employer who uses computer scoring of job applications to decide who to interview. In some circumstances, you have the right to prevent decisions being taken about you which are based solely on automatic processing. If you would like more information about this, you will find further information in Preventing decisions based on automatic processing of my personal information. If the decision taken has the effect of denying you credit, you should also refer to the leaflet called No credit? VI. If a data controller is processing inaccurate information about you, you have the right to request that information be amended or destroyed. If you would like more information on how to exercise this right and what to do if the data controller does not do as you ask, please see: Incorrect information what can I do? If the information which is inaccurate relates to information recorded on the files of a credit reference agency then you will find further information in the leaflet called: No credit? VII. If you have suffered damage and distress as a result of a data controller failing to comply with the Law you have the right to claim compensation from the data controller. If you would like more information on how to do this please refer to the leaflet called: Claiming compensation. VIII. What do I do if I want to issue court proceedings against a data controller? 5

9 Where a solution cannot be reached by writing to a data controller, the Law allows you to take legal proceedings against the data controller. These proceedings may be commenced either in the civil courts or in the Royal Court of Jersey. For information as to how to make an application to Court please refer to the leaflet called Taking a case to court. Please note: The Commissioner and his staff will not usually be involved in court proceedings commenced by you. The Commissioner is not able to advise on individual cases and their likelihood of success and you are advised to consult a solicitor, Citizen s Advice or your mediation centre if you are not sure whether you have a case under the Law before commencing proceedings. What is in the Information Packs? Each Information Pack sets out what your rights are and, where possible, includes examples of letters and notices to send to the data controller. You will also find information to help you if you decide to take legal proceedings against a data controller. 6

10 Other publications in this series 2. Subject Access - A guide for data subjects 3. Incorrect information - What can I do? 4. Help! How can I stop them processing my personal information? 5. Stopping unwanted marketing materials 6. Preventing decisions based on automatic processing of my personal information 7. Claiming compensation 8. Taking a case to court All the Information Packs and other publications produced by the Data Protection Commissioner referred to in this publication may be obtained from our website or by telephoning

11 Useful Contact Information: Citizens Advice Bureau The Annexe St.Paul's Community Centre New Street St.Helier Jersey JE2 3WP T: (Freephone) W: Jersey Law Society 40 Don Street St Helier Jersey JE1 4XD T: +44 (0) F: +44 (0) W: Channel Island Association of Accredited Mediators (CAAM) W: Jersey Advisory & Conciliation Service (JACS) Trinity House West Centre Bath Street St Helier Jersey JE2 4ST T: +44 (0) F: +44 (0) W: [email protected] 8

12 CONTACT THE COMMISSIONER: Enquiries and Publication Requests: T: F: gov.je W: Office of the Data Protection Commissioner Morier House Halkett Place St.Helier Jersey JE11DD 9